# Custom software and agencies: who is the manufacturer when you build for a client? Canonical: https://craguard.eu/blog/custom-software-who-is-the-manufacturer Language: en Last updated: 2026-09-02 - [CRAguard](https://craguard.eu/)/ - [Blog](https://craguard.eu/blog)/ - Custom software and agencies: who is the manufacturer when you build for a client? 5 Sep 2026 · CRAguard Summary The manufacturer under Art. 3 is whoever places the product on the market under their own name or trademark — for custom development that's usually the client, not the agency. But not always: if you appear under your own brand or place the product on the market yourself, you're the manufacturer (Art. 3). The boundaries of custom development are being refined in the Commission guidance; where it isn't clear, handle it by contract. Either way, the agency provides the client with inputs: an SBOM, secure-by-design documentation, cooperation on vulnerabilities. "We built an app for a client — who is the manufacturer under the CRA now?" This question troubles every agency and freelancer. The answer has a clear core and grey edges. Let's work through both, so you know where you stand and what to put in the contract. ## The core: it turns on who places it on the market under their brand Under **Article 3**, the manufacturer is whoever develops the product or has it developed and **places it on the market under their own name or trademark**. For classic custom development this means the **manufacturer is usually the client** — it's their product, their brand, they put it out to people. The agency is in the role of developer/subcontractor, not manufacturer. That's the rule that holds in most cases: you built the app, the client releases it under their name → the manufacturer is the client. ## When you become the manufacturer The rule has exceptions, and you should know them. Points 1–2 follow directly from the definition of manufacturer (Art. 3); point 3 from the substantial-modification rule for a third party (Art. 22). You become the manufacturer if: - **you place the product on the market under your own brand** — e.g. you sell it as your finished product to several customers, - **you place the product on the EU market yourself** in your own name, not just hand it to the client, - **you make a substantial modification** to an already-placed product that affects its conformity. Put differently: the more you're "just the hands coding for the client's brand", the sooner the client is the manufacturer. The more it's *your* product that you merely sell to various customers, the sooner you are. Scope-checker ### Find out whether the CRA applies to you Six questions, two minutes, no account. Get your product class and first steps. [Start the scope-checker](https://craguard.eu/checker) ## The grey edges — and what to do about them Not everything is black and white. Custom development has cases the regulation doesn't directly settle and which the **Commission guidance** refines with examples: e.g. software tailored to a single client that isn't further "made available on the market" in the ordinary sense, or split responsibility when several parties work on the product. **As of this article's date, not all such edges are firmly settled** — which is precisely why you can't do without a contract. In practice: in the contract with the client, **explicitly clarify who the manufacturer is** and who bears which duties (documentation, reporting, support period). It's not just a legal formality — it determines who files the report at the first incident and who answers to the surveillance authority. ## What to put in the contract specifically Because the split of roles is partly a matter of agreement, it pays to settle at least these points in the contract with the client: - **Who is the manufacturer** under the CRA and who places the product on the market under their brand. - **Who bears the manufacturer's duties** — technical documentation, declaration of conformity, Article 14 reporting, the support period. - **What the agency provides as inputs** — the SBOM, a description of secure-by-design measures, possibly test reports. - **How and by when the agency responds to vulnerabilities** in the delivered code during the support period (deadlines, contact). - **What happens after the engagement ends** — handover of the SBOM and documentation so the client can continue. It's not just a legal formality: at the first incident, exactly these clauses determine who files the report and who answers to the authority. Clarifying them upfront is far cheaper than arguing during a 24-hour deadline. ## What an agency provides either way Even when the client is the manufacturer, the agency doesn't escape the obligations entirely — they simply arrive **through the contract**, not directly from the law. The client will (and should) ask for inputs it can't produce for its documentation itself: - the **SBOM** of the product you built, - **secure-by-design documentation** — how you handled security during development, - **cooperation on vulnerabilities** during the support period — when a problem appears in your code, the client will need your response. This is, incidentally, also a business opportunity: an agency that can supply these inputs with every project is more valuable to a client than one that shrugs at a CRA question. ## FAQ - **We built an app and the client releases it under their brand — who's the manufacturer?** Usually the client (they place the product on the market under their name, Art. 3). - **We sell the same "finished" product to several clients under our name — now what?** Then you're the manufacturer — it's your product, not bespoke work. - **We only maintain someone else's product — are we the manufacturer?** Ordinary maintenance no; but a substantial modification affecting conformity can flip you to manufacturer (Art. 22). - **A freelancer without a company — does that change anything?** No, the role decides (who places it on the market under their brand), not the legal form. ## Why it's also a business opportunity An agency that can supply an SBOM, a description of secure-by-design measures and cooperation on vulnerabilities with every project is more valuable to a client than one that shrugs at a CRA question. The client needs those inputs for its [technical documentation](https://craguard.eu/blog/self-assessment-module-a-technical-documentation) — and if you provide them, you ease their life and stand out. A duty thus becomes an argument for working with you. ## Key point Who is the manufacturer in custom development? The core is clear: the manufacturer is whoever places the product on the market **under their own name or brand** (Art. 3) — for a classic commission, that's the client, not the agency. Know the exceptions: you become the manufacturer if you sell the product under your own brand or place it on the market yourself (you're the manufacturer by the definition in Art. 3), or make a substantial modification to it (Art. 22). Some edges of custom development aren't firmly settled as of this article's date and are being clarified by the Commission guidance — so you can't do without a contract that explicitly clarifies who is the manufacturer and who bears which duties. Even when the client is the manufacturer, the agency doesn't escape duties entirely: by contract it provides an SBOM, secure-by-design documentation and cooperation on vulnerabilities. That can even become a competitive advantage — an agency that delivers these materials with every project is more valuable to the client. ## How CRAguard helps CRAguard is built for agencies too: for each client project it keeps an SBOM, vulnerability monitoring and an audit trail you hand to the client as evidence of a secure-by-design approach and cooperation. Instead of hunting manually at every question, your inputs are ready. [Find out whether the CRA applies to you](https://craguard.eu/checker), or [join the waitlist](https://craguard.eu/#waitlist). *This article is informational and not legal advice. It is based on Regulation (EU) 2024/2847 (Art. 3 definition of manufacturer, Art. 22) and the European Commission's guidance of 27 July 2026. Some boundaries of custom development are not firmly settled as of this article's date — consult a professional on specific cases and handle them by contract.* Scope-checker ### Find out whether the CRA applies to you Six questions, two minutes, no account. Get your product class and first steps. [Start the scope-checker](https://craguard.eu/checker) ## Sources - [EUR-Lex — Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj) - [ENISA — Single Reporting Platform](https://www.enisa.europa.eu/) --- Source: CRAguard — https://craguard.eu